A denial of service vulnerability exists when a user with read access submits a query that uses array expressions to generate excessively large intermediate objects in memory. The malformed query causes the MongoDB Server to run out of memory and crash with an OOM error, taking the database service offline. This weakness is identified as CWE‑1325 and provides no code execution or data exfiltration capability.

The flaw affects all MongoDB Server deployments that have not been updated to a release containing the fix committed to SERVER‑124355. No specific version range is listed, so the risk applies to every release prior to the patch.

With a CVSS score of 7.1, the vulnerability is considered moderate to high. An attacker only needs standard read access to the database to submit the crafted query; no elevated privileges or lateral movement are required. The EPSS score of less than 1% indicates a low but non‑zero probability of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog, meaning no widespread exploitation has been publicly reported. Nonetheless, any user capable of submitting a query could trigger the DoS, making it important to mitigate early.